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Abstract 

A simple and efficient protocol for quantum oblivious transfer is 
proposed. The protocol can easily be implemented with present tech- 
nology and is secure against cheaters with unlimited computing power 
provided the receiver does not have the technology to store the par- 
ticles for an arbitrarily long period of time. The proposed protocol 
is a significant improvement over the previous protocols. Unlike the 
protocol of Crepeau and Kilian which is secure if only if the spin of 
the particle is measured along the x or the y axis, the present protocol 
is perfectly secure no matter along which axes the spin of the particles 
are measured, and unlike the protocol of Bennett et al. which requires 
tens of thousand of particles, the present protocol requires only two 
particles. 
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In 1970, Wiesner [Q] wrote a highly innovative paper about quantum 
cryptography , introducing a new branch of Physics and computation. In 
his original paper, he also introduced the concept of Multiplexing, which was 
later rediscovered by Rabin |]^, and is now usually called Oblivious Transfer 
(OT) The concept of OT has turned out to be a very useful tool in 
designing cryptographic protocols, and has been used for quite a while as 
a standard primitive tool for constructing more complex protocols. Let us 
briefly describe the OT protocol: 

1 - Alice knows one bit A, where A is either 1 or —1 0|. 

2 - Bob obtains bit A from Alice with probability 0.5. 

3 - Bob knows whether or not he obtained bit A. 

4 - Alice does not learn whether or not Bob obtained bit A. 

Crepeau and Kilian have suggested that OT can simply be achieved 
by having Alice send Bob a single spin ^ particle, for example an electron, 
encoding the OT bit into the spin of the particle along the horizontal or 
vertical axis (or encoding the OT bit in polarization of the photon along 
the horizontal or diagonal axis). Bob then randomly chooses the x or the 
y axis, and measures the spin of the particle along that axis. Finally Alice 
tells Bob the correct axis. This simple protocol is secure if and only if Bob 
measures the spin of the particle along the horizontal or the vertical axis. For 
example if Bob measures the spin of the particle along the diagonal axis, he 
will then obtain a considerable amount of partial information about Alice's 
bit 0. Bennett et al. have proposed a protocol for quantum OT which is 
free from this disadvantage; but their protocol is rather inefficient, requiring 
tens of thousands of particles to be sent and received for a simple decision 
making. It is worth noting that all previous quantum oblivious protocols are 
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insecure against EPR attack. 

In this paper, we propose a simple and efficient protocol for quantum 
OT. The protocol is a considerable improvement over the previous protocols. 
Unlike the protocol of Bennett et al, the present protocol requires only two 
particles to be sent for a simple decision making, and unlike the protocol 
of Crepeau and Kilian, the proposed protocol is perfectly secure no matter 
along which axes the spin of the particles are measured. 

The proposed protocol consists of the following steps: 

(1) Alice and Bob agree that A is encoded in the product of the spin of 
the two particles along the horizontal axis or along the vertical axis, i.e., 
A is encoded in 6162, where bi and 62 are spins of the first and the second 
particles along the horizontal axis, or bi and 62 are spins of the first and the 
second particles along the vertical axis (here horizontal axis refers to x or —x 
axes and vertical axis refers to y or —y axes). They also agree that bi — 1 

TT 

(62 — 1) indicates that spin of the first (second) particle is along or — axis, 
and 61 = —1 (62 = —1) indicates that spin of the first (second) particle is 
along TT or — axis. For example if A = 1, and if Alice decides to encode A in 
the product of the spin of the two particles along the horizontal axis, then 
she prepares two particles with their spins along the x axis, or two particles 
with their spins along the —x axis. Similarly if A = — 1, and if Ahce decides 
to encode A in the product of the spin of the two particles along the vertical 
axis, then she prepares two particles with spin of the first particle along the 
y axis and spin of the second particle along the —y axis or spin of the the 
first particle along the —y axis and spin of the second particle along the y 
axis. 

(2) Ahce encodes A in b\bi and sends Bob the two particles. 
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(3) Bob measures the spin of both particles randomly along the x axis or 

along the y axis. 

(4) Alice asks Bob if his measurements have been successful. If Bob says no, 
then Alice goes to step 2. If Bob says yes, then Ahce tells him only one of 
the following two alternatives: 

(i) A is encoded in the product of the spin of the two particles along the 
horizontal axis, 

{ii) A is encoded in the product of the spin of the two particles along the 
vertical axis. 

We now show that if Bob does not have the technology to store the parti- 
cles until step 4, then the above oblivious transfer protocol is secure against 
cheaters with unlimited computing power. First note that if Bob is honest, 
then the oblivious transfer protocol can succeed without any difficulty. For 
example, assume A is encoded in the product of the spin of the two particles 
along the horizontal axis. If Bob measures the spins of the particles along 
the X axis, then he learns the value of A; but if he measures the spins of the 
particles along the y axis, then he does not gain any information about A. 

Now consider a cheating Bob who measures the spin of the first particle 
along axis a at angle a with respect to the x axis, and measures the spin of 

— * 

the second particle along axis h at angle (3 with respect to the x axis. The 
result of his measurement on the first photon can be represented by a random 
variable h\ which takes values in the set {1,-1}. According to the standard 
rules of quantum theory 



where 9 is the angle at which the spin of the first particle is measured by 
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(1) 



Alice and is in the set j'-'' 2' ' ^' ~2~ J ' ^^^^^^^^ result of his measurement 
on the second photon can be represented by a random variable b'2 taking 
values in the set {1,-1}. Again according to quantum theory 



p {b'2 = 1 I 62 = 1) = cos' I ] , p {h'2 = -1 I 62 = -1) = COS- 



p (6'2 = 1 I 62 = -1) = sin' ^- — - , p {b'2 = -1 I 62 = 1) = sin' 



(2) 



where (p is the angle at which the spin of the first particle is measured by by 
Alice and is in the set |o, — . n. —1. 

Without loss of generality, first we assume A = 1. We now asks the 
following question: Given that A = 1, what is the probability that Bob will 
obtain A' = 1, i.e., what is p(A' = 1 | A = 1)? To answere this question, 
we note that A is encoded along the horizontal and vertical axes with equal 
probability, i.e., 

p (A' = 1 I A = 1) = p {b'^b'2 = 1 I 6162 = 1) 

= p{H)p{b',b'2^1\bib2^1,H) 

+ p{V)p{b',b'2 = l\bib2 = l,V), (3) 

where H means A is encoded along the horizontal axis and V means A is 
encoded along the vertical axis. We now note that 

p {b',b'2 = 1 I 6162 = l,H) = p{b, = 1,62 = l)p {b'A = 1 I 61 = 1,62 = l,H) 

+ p{b,^ -1, &2 = -1) P {b'A = 1 I 61 = -1, 62 = -1, H) , 

p {b[b'2 = 1 I 6162 = 1,1^) = P {bi = 1,62 = l)p {b'A = 1 I 61 = 1,62 = 1, V) 

+ p{b,^ -1,62 = m = 1 I 61 = -1,62 = -1,V) . 

(4) 



Since Alice encodes A along x and —x with equal probability, 



p ih = -1,62 = -1) = ^, P {bi = 1,62 - 1) = ^, 



(5) 



we thus have 



p m = 1 I 6162 = = ^P {K = 1 I 61 = l,iy)/> (6^ = 1 I &2 = 1,H) 
+^p {b[ = 1 I 61 = (6'2 = 1 I 62 = -1,//) 

= -1 1 61 = (6'2 = -1 1 62 = 

+^p {b[ = -1 I 61 = (6'2 = -1 I 62 = 







cos^ 










sin^ 







cos 



sm l-,sm 



Similarly 



(6) 



p {h% = 1 1 6162 = 1, V) = = 1 1 61 = i,v)p = 1 1 62 

{h[ - 1 I 61 - (6^ = 1 I 62 = 

(6; = -1 1 61 = (6^ = -1 1 &2 = 



+ 2^^ (^'1 = -1 I ^1 = (^'2 = -1 I i'2 = -1,^) 



'fi n 



cos COS 

2 4; I 2 4, 



q; tt 

sm" 1 I sm 

.2 4 



+ sm sm + cos | cos , 

.2 4; I2 4/ V2 4; V2 



/3 _ TT 
2 I TT^ 



(7) 



Using Eqs. (3), (6) and (7), and noting that p (H) = p (V) = ^, we obtain 



p (A' = 1 I A = 1) 



'a IT 

+ COS^ ( — - - I COS 



COS 

2 



COS 



'/5 



2 + sm y-] sm' 



a 



+ sin^ 



a TT 

I sm 

2 4 



I 2 4 
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Using the following simple trigonometric relations, 

cos (71 - 72) = COS71 COS 72 + sin7i sin 72, 

• \ ^ • 9 1 + cos(27) _ . 

sm (27) = 2 sm 7COS7, cos 7 = — -, (8) 

Eq. (7) may be simplified to 

1 1 

p (A' = 1 I A = 1) = 0+7 (^°^ acos /? + sin a sin 0) 

= ^ + |Cos (9) 



Obviously 



j9 (A' = -1 I A = 1) = l-p(A' = l I A = l) 



= ^-^cos («-/?). (10) 

The probability that A' = 1 (A' — —1) given that A = 1 is maximized 
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(minimized) \i a — ^ and the maximum (minimum) value is - ( ^ )■ Thus 
the best strategy for a cheating Bob is to measure the spin of both particles 
along the same axis, in which case he would obtain as much information as 
an honest Bob who measures the spin of both particles along the x or along 
the y axis, i.e., a cheating Bob can not gain any more information about A 
than an honest Bob. 

Next we assume that A = —1. We now ask the following question: 
Given that A = —1, what is the probability that A' = 1, i.e., what is 
p(A' = l|A = — 1)? To answere this question, again we note that A is en- 
coded along the horizontal and vertical axes with equal probability, i.e., 

p (A' = 1 I A = -1) = V {b[h'^ = 1 I bib2 = -1) 

= p{H)p{b[b'^^l\hb2^-l,H) 

+ p{V)p{b[b', = l\b,b2 = -l,V). (11) 



We now note that 



p (b[b'^ = 1 1 6162 = 


-l,H) 




= 1,^2 = 


-l)p{h%^ 


1 


61 = 


1,&2 = 






+ P (61 


= -1,62 


= i)pm = 


1 


bi = 


-1,62 


P {h% = 1 1 &1&2 = 






= 1,^2 = 


-i)pm^ 


1 




1,&2 = 






+ P (&i 


= -iM 


= i)pm = 


1 


bi = 


-1,^>2 



■1,^), 



Since Alice encodes A along x and —x with equal probability, 



(12) 



P {h = 1,&2 = -1) = ^, P (&1 = -1,&2 = 1) = ^> 



(13) 



we thus have 



p (b[b'^ = 1 I 6162 = -1,//) = ^P {b[ = 1 I 61 = l,//)p (6^ = 1 I 62 = -1,H) 

+ iK = -1 I 61 = (&2 = -1 I &2 = -l,i/) 

(6; = 1 1 61 = -i,i/)p (6'2 = 1 1 62 = 1,//) 

(6i = -1 I 61 = -l,i/)p (6'2 = -1 I 62 = l,H) 



-,2 ^ 



COS" I — ] sin^ f — I + sin^ ( — I cos" I — 



+ smM|) cos^ (f 



cos"l-jsm - 



Similarly 



(14) 



p {b[b', = 1 I 6162 = -1,V) = -p (6i = 1 I 61 = l,l^)p (6^ = 1 I 62 = -1,^) 



+^p{b[ = -l\b, = l,V)p{b', 



l\b2 = -l,V) 



+-P {b[ = 1 I &i = -l,V)p {b', = 1 I 62 = 1, v^) 
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1 

" 2 



cos 



= -1 


bi-- 
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U " 


i) 






-i) 


cos 







2 ^ \ , • 2 

' 2"! 



a 7r 

I cos 

2 4 



2 I ^ _ ![ 

I 2 4 



'(3 TT 



+ sm" - - - cos - - - + cos - - - sm" - - - 



2 4 



2 4 



2 4 



(15) 



Again using the fact that p [H] = p (V) = - and referring to Eqs. (11), (14), 
and (15), we have 

p (A' = -1 I A = -1) = 



a 



a 



cos" 1 — I sm^ I — I + sin^ I — I cos , 
27 \2 \2j \2 



a TT 



71 



+ COS — — 7 sm — — - + sm — — - cos — — - 



a TT 



Simphfying the above equation, we obtain 

1 1 

p(A'=l|A = — 1) = (cos a cos (3 — sin a sin (3) 

2 4 

— - — - cos {a — /3) . 



(16) 



(17) 



Obviously 



p (A' = -1 I A = -1) = 1-p (A' = 1 I A = -1) 



(18) 



The probabihty that A' = 1 (A' = —1) given that A = — 1 is minimized 
(maximized) if a — /3 and the minimum (maximum) value is - ^-^ . Thus 
the best strategy for a cheating Bob is to measure the spin of both particles 
along the same axis, in which case he would obtain as much information as 
an honest Bob who measures the spin of both particles along the x or along 
the y axis. Finally it should be noted that Bob can cheat by storing the 
particles until step 4 and then perform his measurements. This sophisticated 



9 



attack, which is in principle possible, is completely infeasible at present or in 
the foreseeable future. 

To summarize, a cryptographic protocol for quantum OT is proposed. 
The protocol is a significant improvement over the previous protocols. Un- 
like the protocol of Kilian and Crepeau which is secure if and only if the spin 
of the particles are measured along the horizontal or vertical axis, the present 
protocol is secure no matter along which axis the spin of the particles are 
measured, and unlike the protocol of Bennett et al. which requires tens of 
thousand of photons, the present protocol requires only two photons. How- 
ever, similar to previous protocols, the present protocol is not secure against 
EPR attack. The advantage of the present protocol is that it is extremely 
simple, highly economical and is secure against cheater with technology that 
is available today or in foreseeable future. 
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